canic_core/api/auth/
root.rs

1//! Module: api::auth::root
2//!
3//! Responsibility: adapt root-only issuer policy, renewal, and chain-key proof calls.
4//! Does not own: root timer execution, batch signing, or proof install state.
5//! Boundary: verifies root context and delegates to auth workflow.
6
7use super::AuthApi;
8use crate::{
9    cdk::types::Principal,
10    dto::{
11        auth::{
12            RootChainKeyPublicKeyRequest, RootDelegationProofBatchProof, RootIssuerPolicyResponse,
13            RootIssuerPolicyUpsertRequest, RootIssuerRenewalStatusRequest,
14            RootIssuerRenewalStatusResponse, RootIssuerRenewalTemplateResponse,
15            RootIssuerRenewalTemplateUpsertRequest,
16        },
17        error::Error,
18    },
19    ops::{ic::IcOps, runtime::env::EnvOps},
20    workflow::runtime::auth::RuntimeAuthWorkflow,
21};
22
23impl AuthApi {
24    /// Derive the public key for this Root without exposing signing authority.
25    pub async fn root_chain_key_public_key(
26        request: RootChainKeyPublicKeyRequest,
27    ) -> Result<Vec<u8>, Error> {
28        EnvOps::require_root().map_err(Error::from)?;
29        RuntimeAuthWorkflow::root_chain_key_public_key(request)
30            .await
31            .map_err(Error::from)
32    }
33
34    /// Upsert root issuer policy from the local root controller path.
35    pub fn upsert_root_issuer_policy_root(
36        request: RootIssuerPolicyUpsertRequest,
37    ) -> Result<RootIssuerPolicyResponse, Error> {
38        EnvOps::require_root().map_err(Error::from)?;
39        RuntimeAuthWorkflow::upsert_root_issuer_policy(request).map_err(Self::map_auth_error)
40    }
41
42    /// Upsert root-managed renewal template from the local root controller path.
43    pub fn upsert_root_issuer_renewal_template_root(
44        request: RootIssuerRenewalTemplateUpsertRequest,
45    ) -> Result<RootIssuerRenewalTemplateResponse, Error> {
46        EnvOps::require_root().map_err(Error::from)?;
47        RuntimeAuthWorkflow::upsert_root_issuer_renewal_template(request)
48            .map_err(Self::map_auth_error)
49    }
50
51    /// Report root-managed renewal template/state for one issuer.
52    pub fn root_issuer_renewal_status_root(
53        request: RootIssuerRenewalStatusRequest,
54    ) -> Result<RootIssuerRenewalStatusResponse, Error> {
55        EnvOps::require_root().map_err(Error::from)?;
56        Ok(RuntimeAuthWorkflow::root_issuer_renewal_status(request))
57    }
58
59    /// Return or create a chain-key root delegation proof for the registered issuer caller.
60    pub async fn get_or_create_chain_key_delegation_proof_root()
61    -> Result<RootDelegationProofBatchProof, Error> {
62        EnvOps::require_root().map_err(Error::from)?;
63        RuntimeAuthWorkflow::get_or_create_chain_key_delegation_proof_for_issuer_root(
64            IcOps::msg_caller(),
65        )
66        .await
67        .map_err(Self::map_auth_error)
68    }
69
70    /// Create or reuse and install a chain-key delegation proof for one issuer.
71    ///
72    /// Root applications may call this after installing or reinstalling an
73    /// issuer so delegated-token issuance is ready before the first login.
74    pub async fn provision_chain_key_delegation_proof_for_issuer_root(
75        issuer_pid: Principal,
76    ) -> Result<(), Error> {
77        EnvOps::require_root().map_err(Error::from)?;
78        RuntimeAuthWorkflow::provision_chain_key_delegation_proof_for_issuer_root(issuer_pid)
79            .await
80            .map_err(Self::map_auth_error)
81    }
82}
canic_core/api/auth/root.rs

canic_core/api/auth/
root.rs
